Categories

Blogs I Follow

Disclaimer

Posts. The views expressed here are solely the authors' and should not be attributed to Hicks Morley Hamilton Stewart Storie LLP or its clients. The material and information provided on this website are for general information only and should not, in any respect, be relied on as legal advice or opinion. The authors make no claims, promises or guarantees about the accuracy, completeness, or adequacy of any information linked or referred to or contained herein. No person should act or refrain from acting in reliance on any information found on this website or blog, without first retaining counsel and obtaining appropriate professional advice from a lawyer duly licensed to practice law in the relevant jurisdiction. These materials do not constitute legal advice and do not create a lawyer-client relationship between you and any of the authors or Hicks Morley. The authors act only on behalf of management. They welcome management-side inquires, but interested persons should not send any information about their matters to the authors in initial communications and before they have had a chance to complete a conflict check. Comments. Comments published on this site do not reflect the views of the authors or Hicks Morley.

Disputes about employer medical information consent forms are now common. It’s not hard to pick apart a form, and employers tend to suffer “cuts and bruises.” In once such case an arbitrator has recently held that an employer must identify “anyone with whom the information would be shared” in a consent form. The arbitrator also held that an employer must subsequently (and seemingly proactively) give notice of who is handling information:

I agree with the employer that it is not practical to obtain a new consent every time a manager or HR Specialist who is absent is temporarily replaced. However, the employer must advise the employee of the employer’s need and intention to share health information with a replacement and identify that individual by name and title. This would enable the employee to revoke the consent if he/she does not wish the health information to be shared with the individual replacing the manager or HR Specialist. If and when it becomes necessary to share health information with HR or legal services in order to seek advice, or to obtain approval from senior management with delegated authority, the employee should be informed of the title or office only of the person with whom information will be shared. The employee’s consent would not be required for the employer to be able to do so.

While there’s no debating an employee’s right of control, the degree of transparency required here is very high and operationally challenging in the least. “Person-based consents” (as opposed to “purpose-based consents”) can also restrict important flows of information in subtle yet problematic ways.

The best argument against person-based consents is one that refers to the public policy that is reflected in the Personal Health Information and Protection Act (which does not govern employers acting as employers except via section 49). Even in the health care context – where the standard should be higher, not lower than in the employment context given the limited range of information processed by employers – consent is deemed to exist for a certain purpose and information can flow to any health care provider for that purpose. This is subject to a “lock box” that gives patients the ability to shield their information from specific individuals, but the lock box essentially functions as an opt out. (For the nuances of how PHIPA’s “circle of care” concept works, see here.) Transparency is satisfied by the publication of a “written public statement” (a policy really) that “provides a general description of the custodian’s information practices.” There’s no reason to require more of employers.